OpenStack Security Advisory: 2014-036 CVE: CVE-2014-7230, CVE-2014-7231 Date: October 15, 2014 Title: Potential leak of passwords into log files Reporter: Amrith Kumar (Tesora) Products: Cinder and Nova (versions up to 2014.1.3) Trove (versions up to 2014.1.2)

Description: Amrith Kumar from Tesora reported two vulnerabilities in the processutils.execute() and strutils.mask_password() functions available from oslo-incubator that are copied into each project's code. An attacker with read access to the services' logs may obtain passwords used as a parameter of a command that has failed (CVE-2014-7230) or when mask_password did not mask passwords properly (CVE-2014-7231). All Cinder, Nova and Trove setups are affected.

Kilo (development branch) fixes: https://review.openstack.org/116927 (Cinder) https://review.openstack.org/126052 (Cinder ssh_execute) https://review.openstack.org/116982 (Nova) https://review.openstack.org/126047 (Nova ssh_execute) https://review.openstack.org/121417 (Trove)

Juno (proposed branch) fixes: https://review.openstack.org/126594 (Nova ssh_execute) https://review.openstack.org/126592 (Cinder ssh_execute)

Icehouse fixes: https://review.openstack.org/121382 (Cinder) https://review.openstack.org/126665 (Cinder ssh_execute) https://review.openstack.org/121096 (Nova) https://review.openstack.org/126699 (Nova ssh_execute) https://review.openstack.org/121416 (Trove)

Notes: The former patch did not cover the ssh_execute method used in Nova and Cinder, thus two more patches are required for these projects. Nova and Cinder fixes are included in the 2014.2rc2 release candidate and will appear in a future 2014.1.4 release. Trove fix was included in the 2014.2rc1 release candidate and 2014.1.3 release.

References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7230 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7231 https://launchpad.net/bugs/1377981 https://launchpad.net/bugs/1343604 https://launchpad.net/bugs/1345233